0

My setup consist of 3 VMs :

  • "SENDER"
  • "RECEIVER"
  • "SNIFFER"

On "RECEIVER" I'm trying port mirroring with :

iptables -t mangle -A PREROUTING -i eth0 -j TEE --gateway "SNIFFER"

It's working, however, on "SNIFFER" I receive many times the amount of packets initially sent (for 5 packets transmitted, I get 155 duplicates).

Why?

P.S : It's on Ubuntu Server 16.04 LTS

0

1 Answer 1

1

I had a similar problem, and it turned out it was related to packet forwarding. I had to disable forwarding on SNIFFER node (or at least, restrict it) using a command like that:

sudo sysctl net.ipv4.ip_forward=0

If forwarding is enabled, mirrored packets are forwarded back by the SNIFFER node which explains why they appear multiple times in the packets captures.

Hope this will solve your issue.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.